Vulnerability · Published Sep 15, 2021 · Assigned by @huntrdev
CVE-2021-3785Cross-site Scripting (XSS) - Stored in yourls/yourls
High 8.8
In plain English
A high-severity cross-site scripting in yourls/yourls from yourls. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)8.8High
Exploit odds (30 days)0.7%top 45.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | yourls/yourls | 1.8.2 | GHSA-m9fq-c9hp-59g7 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| yourls | yourls/yourls | unspecified – before 1.8.2 |
Weakness: CWE-79 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://huntr.dev/bounties/b4085d13-54fa-4419-a2ce-1d780cc31638 x_refsource_CONFIRM
- https://github.com/yourls/yourls/commit/1d8e224ebabb8a4c75b97f026950ed710faab0ff x_refsource_MISC